Hacker News Reader

Comment by ev1 | Hacker News Reader

The chinese app wechat already does this in private homes for the purpose of enforcing KYC and "misinformation tracking" - you are required to repeat after it, repeat every phoneme/syllable to form a voiceprint (and coincidentally enough to basically train something to replicate your speech), look straight ahead, rotate around your head, and follow its instructions to sign in again.

Also, asking two verified-ID mainland china users to "vouch" for you and be responsible for your activities if you are a foreigner.

Almost every service in China requires "real name verification" - you can't play games without it, for example.

This has been place for several years, https://i.imgur.com/FBrCwuX.jpg

View on HN

This verification process exists in Europe as well (it's called liveness verification), example: https://www.jumio.com/technology/live-detection/

The technology exists, right. But have you experienced it anywhere outside of China? I, for one, have not (at least in the UE). I strongly believe that the average western customer is not be willing to go through such a process.

Most (all maybe?) of the new German banks and fintech products seem to offer it as they have no physical branches, you can often open accounts directly from your smartphone. Some will offer a way of identifying yourself via a post office with your passport too.

What the person above means is different. If you open an account, nowadays you have to ask someone that already has a Wechat account to scan a QR code to vouch that you are indeed who you claim to be. It doesn't actually do ID identification though and it doesn't have to be a Chinese mainland user. It can be any other active Wechat account. Full ID Identification only works with a China mainland bank account IIRC.

What the person above implies is that the other two are on the hook when you start spreading any Government information. I'd assume that the government would investigate anyone in your friend list if you do that though regardless of whether they verified you or not, so it's kind of a minor detail in my opinion.

> What the person above means is different

What person? The first paragraph in ev1’s comment (and the ‘liveness’ reference in the reply) are not about ‘vouching’.

Really? I’m outside of China, and signed up for WeChat (for work) but never had to do any of the KYC things. They only took my number to send an OTP.

If they ask for KYC in the mainland I suppose it’s understandable since it serves a lot more than a chat app there (payment, SSO for a lot of other services).

When I tried to install WeChat because I was going to travel to China, it kept making me verify my account repeatedly, I guess it was because my phone was rooted...

Got it, thanks for clarifying.

This is for the equivalent of Facebook Messenger or playing a F2P game, not fintech - bank requires even more, and linking a "real name ID" IRL bank account anyway.

Wechat in the mainland actually does do fintech.

Basically every modern "mobile-first" bank/stock brokerage app, etc. is built on that. With a lot of them there is still a human in the process giving you the instructions (usually from a call center), but it's gradually shifting to tech-only solutions.

I used it to access my medical records from the UK without actually going to the UK.

I thought that was reasonable, but it didn't occur to me that reading the numbers was enough to train an AI to reproduce my voice. Now I'm less sure.

It's common when applying for a credit online. They also make you hold your ID towards the camera, show the hologram, read some text etc.

I called Fidelity in the US about my account, and the agent told me the system was taking a voice print, to be used to verify me the next time I called in.

Did you tell them to opt you out...?

My guess is you can't.

I've signed up for several bank accounts lately (due to the 85k insurance limit on UK banks). All of them had this "liveness verification".

I think it's actually a legal requirement in the UK if they wish to allow you to sign up online.

You cannot activate a sim card in Germany without proof of ID

That's hardly comparable though. No one is taking your voice print and biometric details to match everything you ever say or do against you just to activate a sim card. Not to mention that buying a travel sim card that doesn't require ID is absolutely trivial, or even getting one shipped from any other European country which doesn't have this requirement is simple and easy.

Yeah it's a faff, but at least no one will accuse you of being an enemy of the state if you do this like trying to avoid tagging in China.

> No one is taking your voice print and biometric details

Some Italian cell operators do. For example, when you are buying a new sim card for Iliad, you do this in front of an automated kiosk where you have to scan your ID, then face camera and say outloud "my name is Insert Your Name Here, and I would like to make a phone service contract with Iliad".

Is that for voice printing purposes, or is it in lieu of signing your name on a paper contract?

Ok, I stand corrected then :-) Had no idea this was a thing.

> No one is taking your voice print

SIM cards are used for transmitting voice in an insecure fashion, so you can't be sure. Some voice codecs are even designed to do something very similiar to fingerprinting voices.

> No one is taking your [...] biometric details

They were already taken when you had¹ to get the ID in the first place.

¹ The federal republic directly adopted laws from nazi germany requiring ID for every citizen. This law was initially introduced to acquire data about jews and people fit for military service.

> to match everything you ever say or do against you just to activate a sim card

This was never about surveillance by private entities! Federal agencys can match everything you say based on the fact that the SIM card in your portable bug is linked directly to you.

> but at least no one will accuse you of being an enemy of the state if you do this like trying to avoid tagging in China.

You can be certain that you end up in a database if you use a foreign SIM card from a non-KYC-country for a long period of time in a residential area. Your only defence is your network provider not cooperating unless forced by law.

Germany is being turned into a surveillance state bit by bit and I am fed up by people trying to defend it!

>>You can be certain that you end up in a database if you use a foreign SIM card from a non-KYC-country for a long period of time in a residential area. Your only defence is your network provider not cooperating unless forced by law.

I've literally been doing this for the last 11 years, guess I'm screwed then :P

>>They were already taken when you had¹ to get the ID in the first place.

Yes, and the mobile operator doesn't get them, while in the article discussed it's the "private" operator gathering all this data.

>>SIM cards are used for transmitting voice in an insecure fashion, so you can't be sure.

The difference being, that here it's done openly and in a visible fashion "either you do this, or you can't play our games".

>>¹ The federal republic directly adopted laws from nazi germany requiring ID for every citizen.

That sounds about on a level with an argument that since Hitler was vegetarian, all vegetarians are nazis. Your country adopted a lot of laws from the Third Reich. Mine adopted a lot of laws from the communist republic it once was. Neither fact makes those countries anything like their predecessors. The law that every citizen has to have an ID is a good one IMHO(wait for Americans to chime in and say this is against their personal freedom or something).

> The difference being, that here it's done openly and in a visible fashion "either you do this, or you can't play our games".

So hidden surveillance is more ok than open violations?

> That sounds about on a level with an argument that since Hitler was vegetarian, all vegetarians are nazis.

I just wanted to explain why germans have to have an ID.

>>So hidden surveillance is more ok than open violations?

I knew someone would inevitably come to this conclusion.

No, of course it's not better. But this article is very specifically about an open and overt gathering of biometric data.

In my experience travelling internationally, linking SIM cards to ID (either on purchase, or on activation) is more common than not.

I've had to add this exact functionality ("Look left and repeat these numbers") as part of KYC for a mobile app similar to Revolut.

This is in conjunction with ID scanning.

I think this functionality was necessary as part of complying with KYC laws. And AFAIK WeChat has very similar functionality to Revolut (among much more) so even if the app was non-Chinese (e.g. European), it would need a similar flow.

Yes in Estonia is quite common

Yep, in the UK. My solicitor required it for kyc for a house purchase during the pandemic

Nice. Mine required me to send them certified originals and a handwritten declaration through the post.

Seems I need a more tech-savvy solicitor...

Seems you are in fine hands.

I believe that the average customer anywhere just don't care. I care but nonetheless did go through such a process as it was somewhat required for me to pay taxes on Brazil using 'Gov.br' SSI app.

Yes, in the US, when signing up for cryptocurrency related services like Coinbase or Binance I believe.

Yes, I have.

Which ever service implements this can be sure to have seen the last of me.

You probably play/have played games owned by these companies.

I probably didn't.

KYC?

Know your customer

Basically identifying your customer and confirming their identity, e.g. via a video call or at a post office etc.

Know them so well, you can deepfake them later and make their avatar say whatever you want. Nice job if you can get it!

(Kind of like the scarier version of the store cashier stealing your credit card digits - because you can’t just order a new one.)

"Know Your Customer"

In the West, KYC means that a bank is going to ask to see your ID before letting you open an account.

In China, KYC means that, in order to use something as pedestrian as social media, you have to let the CCP AI dragnet build a profile that can be used to surveil you for the rest of your life.

Wechat is basically a bank as you can use it to send money, hence KYC. If all the CCP wanted was to build a profile they'd just ask for ID and then scoop up every call you make.

Wechat is basically everything for mainland users.

Need to pay registration for car? Wechat

Need to verify covid screening to enter the country as a resident? Wechat

Need to request a taxi? Wechat

Need to pay your electricity bill? Wechat

EVERYTHING is done through wechat.

Yes, indeed. That said put in another way, they're just a bank and Facebook at the same time, which is indeed scary. Not that it would be very different if they were different services for spying purposes, the government can always centralize the data.

I wonder if it's even possible for Chinese citizens to play rouge/nethack.

China is the last rouge world superpower, and also rogue.

Are you discounting that Russia is rogue or a superpower?

Cute, but there's lots of rouge around the world - it's even popular in the USA these days.

As privacy invading it is, I can easily see how this would be effective means to curb bad behavior online, such as trolling or spamming—or worse.

Hahahahahaha, I'm sorry. This is a ridiculous take. It sounds as if you are justifying handing over your entire digital identity, which includes given someone so much information about yourself that you could be easily impersonated, is justifiable because it will cut down on online trolling? Not to mention, you are giving all of this information to a regime that regularly "disappears" people for dissenting stances, and is actually running literal concentration camps.

Nothing in the post you replied to was a justification, and in fact starts with "As privacy-invading as it is".

> As privacy invading it is, I can easily see how this would be effective means to curb bad behavior online, such as trolling or spamming—or worse.

I'm not so sure about that, reading Facebook comment threads on news articles clearly shows that a real name policy isn't really stopping people from misbehaving online.

If Facebook isn't able to make money from moderating such content, then there's no reason to think they would do it.

Might a real name policy have toned down the communication that lead to case Tenacity https://github.com/tenacityteam/tenacity/issues/99 , though?

As human rights invading as it is, I can easily see how forced sterilization would be an effective means to curb bad genetics, such as being short or fat - or worse.

I hope there are very few people with your mentality

What mentality? I did not say it would be worth the price, just that there are things to gain from it.

I did notice nobody outright challenged the actual claim (except for the Facebook comment that touched the topic).

That can already be done through paid accounts and moderation. There is zero excuse for this level of privacy invasion.

Reply on news.ycombinator.com